> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Ransomware: safepay named dwi-bau.de (DE)
- URL: https://f4n6.co.uk/security-feed/ransomware-safepay-named-dwi-bau-de-de/
- Published: 2026-10-10T22:02:37.000Z
- Updated: 2026-10-10T22:02:37.000Z
- Author: Jeff Davies
- Tags: #security-feed, SafePay

## 1\. Executive summary

A ransomware group operating under the name "safepay" listed dwi-bau.de, a German construction-sector company specialising in metal roof and facade systems, on its leak site on 2026-10-09\. The listing is indexed by ransomware.live and consists of a victim name, country, website and a leak screenshot; no data sample, ransom demand, or technical detail of the intrusion has been published. The actor "safepay" has no MITRE ATT&CK profile in our reference data, so the attribution is unconfirmed and the group's tradecraft, tooling and victim-selection pattern cannot be characterised from this item. The direct risk to EMEA financial services clients is low unless dwi-bau.de appears in their construction, facilities or supplier-finance supply chain, in which case the exposure is third-party and contractual rather than technical. No CVE, no exploited component and no CISA KEV entry is associated with this item.

## 2\. Regulatory framing

| Article                                                | Trigger (the fact in this item)                                                                                                                                     | Practical impact                                                                                                                                                                                                                                                                                                               |
| ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| DORA Art. 28: ICT third-party risk, general principles | A named supplier in the construction and building sector has been listed on a ransomware leak site, which is the only evidence of an ICT incident at that supplier. | If dwi-bau.de is a direct ICT third-party provider or a sub-contractor within a critical function chain, the client must assess the incident against its third-party risk register and obtain the supplier's own incident status. The listing alone does not establish that an ICT service the client relies on was disrupted. |
| NIS2 Art. 21(2)(d): supply chain security measures     | The only fact is a leak-site listing of a supplier; there is no evidence the client's own network, or a service the client consumes, was affected.                  | Engaged only where the client has designated this supplier as part of its supply chain security measures under NIS2\. The practical action is to confirm whether the supplier provides any service that supports the client's own essential or important entity obligations.                                                   |

No DORA incident-reporting article (Art. 17, 18, 19) is engaged by this item on the facts available: there is no indication that a client's own ICT systems were affected, and a supplier's leak-site listing is not by itself a major ICT-related incident at the client. No UK NIS 2018 duty is engaged on the facts available.

## 3\. Technical analysis & attack chain

The source material does not describe an attack chain. What is confirmed is limited to the following.

1. On 2026-10-09 at 22:09 UTC, the actor "safepay" published a victim entry for dwi-bau.de on its leak site.
2. The entry names the victim as dwi-bau.de, country DE, website dwi-bau.de.
3. The victim is described as a company specialising in building systems for metal roofs and facades, serving the construction and building sectors.
4. A leak screenshot is referenced on the ransomware.live index page. No data sample, file listing, ransom amount, negotiation status, or proof-of-exfiltration content is present in the source material.

No initial access vector, exploited component or CVE, payload capability, persistence mechanism, privilege escalation path, command-and-control infrastructure, lateral movement, exfiltration method or observed impact is described in the source. The ransomware.live entry is an index record, not a technical report. Any statement about how the intrusion was carried out would be speculation and is not made here.

**Confidence caveat.** The entire item rests on a single source, the ransomware.live index page at https://www.ransomware.live/id/ZHdpLWJhdS5kZUBzYWZlcGF5\. The actor "safepay" has no MITRE ATT&CK profile in our reference data. The listing has not been corroborated by a second source, by the victim, or by a national CERT. Treat the attribution to "safepay" as unconfirmed and treat the existence of exfiltrated data as unverified. Ransomware.live states that it indexes publicly visible operator posts and does not access or distribute the underlying stolen content, so the leak screenshot referenced on the page has not been independently validated by us.

## 4\. Mitigation & containment

The source provides no vendor fix, no patch, no version information and no technical artefact, so the actions below are process and third-party controls, not technical remediation of a named vulnerability.

### P1 (within 24 hours)

- Determine whether dwi-bau.de appears anywhere in your supplier master, accounts-payable vendor list, facilities or construction contracts, or supplier-finance portfolio. If it does not, no further action is required for this item.
- If it does, contact the supplier through a known-good channel (a phone number or address already on file, not one taken from the leak-site page or any email referencing it) and ask directly whether they have an active incident, whether any service they provide to you is affected, and whether any data relating to your organisation was involved.
- Do not visit the leak site from corporate infrastructure and do not download any material referenced there. Indexed leak pages are a common lure and a tracking surface.

### P2 (within 72 hours)

- If the supplier confirms an incident, or if they cannot be reached, treat any service they provide as degraded and identify the internal process that depends on it. For a construction or facilities supplier this is typically invoice approval, site access scheduling or project milestone sign-off.
- Review any open purchase orders, invoices or payment instructions from this supplier for changes to bank details. Supplier-impersonation fraud frequently follows a public ransomware listing, because the listing tells a fraudster which supplier is distracted.
- If the supplier holds any of your data, request a written statement of what categories were involved and whether your organisation's data was in scope.

### P3 (within 7 days)

- Record the outcome in your third-party risk register against DORA Art. 28 if the supplier is a direct ICT third-party provider, or against your NIS2 supply chain measures if the supplier is in scope there.
- If the supplier is in scope for either regime and the incident is confirmed, re-assess whether their contract contains the incident-notification and audit provisions you need. This is a contractual gap check, not a technical one.

## 5\. Indicators of compromise

No indicators of compromise available in the source material. The ransomware.live entry contains no hashes, domains, IP addresses, file paths, registry keys, email addresses or command-line artefacts. The only network value present is the victim's own domain, dwi-bau.de, which is the victim and not an indicator of the actor.

The source does describe one observable behaviour, listed below. It is not machine-pivotable and is not included in a copyable block.

### Behavioural indicators

| behaviour                                                                        | where to observe                                                 | confidence                                             |
| -------------------------------------------------------------------------------- | ---------------------------------------------------------------- | ------------------------------------------------------ |
| A victim entry for dwi-bau.de published on the "safepay" leak site on 2026-10-09 | Ransomware leak-site monitoring feeds; the ransomware.live index | Single-sourced (ransomware.live); verify before acting |

## 6\. Detection

Insufficient indicators to author detection rules. The source contains no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names or paths, registry keys, ransom-note text or hard-coded values. The only named values are the victim domain and the actor name, neither of which is an artefact of the threat itself, and a rule built on them would detect reporting about the incident rather than the incident.

## 7\. Sources

- ransomware.live, "Victim: dwi-bau.de – safepay", https://www.ransomware.live/id/ZHdpLWJhdS5kZUBzYWZlcGF5, published 2026-10-09.

## 8\. Adverse Trace position

Adverse Trace assesses this item as low direct risk to EMEA financial services clients. The only confirmed fact is a leak-site listing; there is no CVE, no CISA KEV entry, no technical detail and no corroborating source, and the actor "safepay" has no MITRE ATT&CK profile in our reference data, so we treat the attribution as unconfirmed. The exposure is third-party and contractual, and it exists only for clients with dwi-bau.de in their supplier or supplier-finance chain. We will continue to monitor the ransomware.live index for a data sample, a second listing by the same actor, or corroboration from a national CERT, and we will re-issue this advisory if the actor's tradecraft or the victim's incident status becomes verifiable. Clients who confirm dwi-bau.de as a supplier should treat the P1 supplier-contact step as the only action this item justifies.

---

[Read the original source →](https://www.ransomware.live/id/ZHdpLWJhdS5kZUBzYWZlcGF5?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*